Performance Analysis for Brandt's Conclusive Entangling Probe 
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The Fuchs-Peres-Brandt (FPB) probe realizes the most powerful individual attack on Bennett- 
Brassard 1984 quantum key distribution by means of a single controUed-NOT gate in which Alice's 
transmitted qubit becomes the control-qubit input, Bob's received qubit is the control-qubit out- 
put, and Eve supplies the target-qubit input and measures the target-qubit output. The FPB 
probe uses the minimum-error-probability projective measurement for discriminating between the 
target-qubit output states that are perfectly correlated with Bob's sifted bit value when that bit is 
correctly received. This paper analyzes a recently proposed modification of the FPB attack in which 
Eve's projective measurement is replaced by a probability operator-valued measurement chosen to 
unambiguously discriminate between the same two target-qubit output states. 



PACS numbers: 03.67.Dd, 03.67.Hk, 03.65.Ta 



I. INTRODUCTION 

In an individual attack on single-photon, polarization- 
based Bennett-Brassard 1984 quantum key distribution 
(BB84 QKD), Eveprobes Alice's photons one at a time. 
Fuchs and Peres Q described the most general way in 
which an individual attack could be performed. Eve 
supplies a probe photon and lets it interact with Al- 
ice's photon in a unitary manner. Eve then sends Al- 
ice's photon to Bob, and performs a probability operator- 
valued measurement (POVM) on the probe photon she 
has retained. Slutsky et al. 0] demonstrated that the 
Fuchs-Peres construct — with the appropriate choice of 
probe state, interaction, and measurement — affords Eve 
the maximum amount of Renyi information about the 
error-free sifted bits that Bob receives for a given level of 
disturbance, i.e., for a given probability that a sifted bit 
will be received in error. Brandt Q extended the Slut- 
sky et al. treatment by showing that the optimal probe 
could be realized with a single CNOT gate; see Fig. 1 for 
an abstract diagram of the resulting Fuchs-Peres-Brandt 
(FPB) probe. Shapiro and Wong 4] then showed how 
a complete physical simulation of the FPB probe could 
be accomplished using singic-photon two-qubit (SPTQ) 
quantum logic 5], and how this arrangement could be 
transformed into a true deterministic realization of the 
FPB attack once polarization-insensitive quantum non- 
demolition photon detection is developed. 
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Consider ideal conditions, in which Alice transmits a 
single photon per bit interval, there is no propagation 
loss and no extraneous (background) light collection, and 
both Eve and Bob have unity quantum efhciency pho- 
todetectors with no dark counts. These conditions hiiply 
there will not be any errors on sifted bits — photons for 
which Alice and Bob have chosen the same polarization 
basis — in the absence of eavesdropping. As discussed in 
0,0,0], when Eve's intrusion causes Bob to suffer an er- 
ror probability Pe on his sifted bits. Eve derives a Renyi 
information equal to 



T 1 A , ^Pe{1-'2Pe) \ 



(1) 



about each of Bob's error-free sifted bits. Thus, Eve's 
Renyi information climbs from to 1 bit per error-free 
sifted bit when Pe increases from to 1/3, as shown in 
Fig. 2. 




FIG. 2: Eve's Renyi information — obtained from the Fuchs- 
Peres-Brandt probe — about Bob's error-free sifted bits versus 
the error probability that her eavesdropping creates. 



FIG. 1: Block diagram of the Fuchs-Peres-Brandt probe for 
attacking BB84 QKD. 
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The preceding performance tradeoff between the er- 
ror probability that Eve creates by her eavesdropping 
versus the Renyi entropy she accrues derives from the 
effect of her CNOT gate on Alice's photon and the pro- 
jective measurement Eve makes on the target-qubit out- 
put from that CNOT gate. The projective measurement 
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is chosen for minimum-error-probability discrimination 
between the two target-qubit output states that are per- 
fectly correlated with Bob's sifted bit value when that bit 
is correctly received. For Pe < 1/3, these target-qubit 
output states are not orthogonal, hence Eve's Renyi in- 
formation is less than perfect in this regime, because non- 
orthogonal states cannot be distinguished without error. 
For Pe > 0, Eve's CNOT gate disturbs Alice's photon— 
the control qubit in Fig. 1 — en route to Bob, so that her 
eavesdropping inevitably injects errors into the otherwise 
ideal connection between Alice and Bob. 

Recently, Brandt has introduced the notion of a con- 
clusive entangling probe 0~I3- essence, this is the 
Fig. 1 configuration with Eve's projective measurement 
replaced by a POVM chosen to unambiguously discrimi- 
nate [loj between the same two target-qubit output states 
considered previously. Brandt's performance analysis for 
the conclusive entangling probe neglects the effect of the 
the third possible output state for Eve's target qubit, 
viz., the state that heralds Bob's receiving a sifted bit in 
error. Thus the purpose of the present paper is to eval- 
uate the performance of Brandt's conclusive entangling 
probe when that third state is included in the analy- 
sis, as it must be. Our work will show that this perfor- 
mance is dramatically different than what Brandt derived 
by inappropriately ignoring the third target-qubit output 
state. We begin, in Sec. II, by reviewing the projective- 
measurement FPB probe, using the notation from 
We continue, in Sec. Ill, with our analysis of Brandt's 
conclusive entangling probe, and conclude, in Sec. IV, by 
discussing the implications of our results. 



II. THE FUCHS-PERES-BRANDT PROBE 

Under the ideal operating conditions that we have pre- 
sumed, the FPB attack on single-photon, polarization- 
based BB84 QKD proceeds as follows. In each bit inter- 
val Alice transmits, at random, a single photon in one of 
the four BB84 polarization states, i.e., |V^), |+45°) or 
|— 45°). Eve uses this photon as the control-qubit input 
to a CNOT gate whose computational basis — relative to 
the BB84 polarization states — is shown in Fig. 2, namely 

|0) = cos(7r/8)|iJ) +sin(7r/8)|F) (2) 
|1) = -sin(7r/8)|ff) +cos(7r/8)|F), (3) 

in terms of the H/V basis. Eve supplies her own probe 
photon, as the target-qubit input to this CNOT gate, in 
the state 



m^)^c\+) + s\-), 



(4) 



where C = x/1 - 2Pe, S = l±) = (|0) ± |l))/\/2, 

and < Pe < 1/2 will turn out to be the error proba- 
bility that Eve's probe creates on Bob's sifted bits. So, 
as Pe increases from to 1/2, |Tin) goes from |-f) to 
|— ). The (unnormalized) output states that may occur 
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► Iff) 



FIG. 3: Computational basis for Eve's CNOT gate referenced 
to the BB84 polarization states. 



for this target qubit are 
\T±) 
\Te) 



C\ + 
^/2' 



± 



-I 

V2' 



(5) 
(6) 



When Alice uses the H/V basis for her photon trans- 
mission. Eve's CNOT gate effects the following transfor- 
mation, 



\V)\Tn- 



\H)\T- 
\V)\T+ 



\V)\Te) 

mTE) 



(7) 
(8) 



where the kets on the left-hand side denote the Al- 
ice (g) Eve state of the control and target qubits at the 
CNOT's input and the kets on the right-hand side de- 
note the Bob (g) Eve state of the control and target qubits 
at the CNOT's output. Similarly, when Alice uses the 
±45° basis, Eve's CNOT gate has the following behav- 



|+45°)|ri„) |+45°)|r+) + |-45°)|ri;) (9) 

h45°)|ri„) |-45°)|r_) + |+45°)|TB). (10) 

Suppose that Bob measures in the basis that Alice has 
employed and his outcome matches what Alice sent. 
Then Eve can learn their shared bit value, once Bob dis- 
closes his measurement basis, by distinguishing between 
the |r+) and |r_) output states for her target qubit. Of 
course, this knowledge comes at a cost: Eve has caused 
an error event whenever Alice and Bob choose a common 
basis and her target qubit's output state is \Te). To max- 
imize the information she derives from this intrusion. Eve 
applies the minimum error probability receiver for dis- 
tinguishing between the single-photon polarization states 
|T+) and |T_). This is a projective measurement onto the 



polarization basis {|d+), 
in Fig. 3 and given by 

M+> = 

\d-) = 



\d-)}, shown (for < Pe < 1/3) 

' = |0) (11) 
= |1)- (12) 



V2 



V2 



Straightforward calculations now show that Pe 



FIG. 4: Measurement basis for Eve's minimum-error- 
probability discrimination between |r+) and |T_); figure as- 
sumes < Pb < f/3. 



is the error probability that Eve's presence creates on 
Bob's sifted bits, and Ir from Eq. (^) is the Renyi in- 
formation that Eve derives about Bob's error-free sifted 
bits. 



III. CONCLUSIVE ENTANGLING PROBE 

Suppose, as in 0-13 j that Eve replaces the projec- 
tive measurement in her FPB probe with 
the POVM 



n. 



n_ 



\T^){T^\ 

\n){Ti\ 



-)(- 



(13) 

(14) 

(15) 
(16) 



where / is the identity operator on the target qubit's 
state space, the (unnormalized) states 



\Tt)^-^\+)±C\-) 



(17) 



are orthogonal to \T±), respectively, see Fig. 5, and Pe 
has been restricted to the interval < Pe < 1/3. Al- 
though our analysis of the conclusive entangling probe 
can be modified to cover an attack with 1/3 < Pe < 1/2, 
we shall not do so. Our reason for eschewing the high- 
Pe regime is that an intelligent Eve would never mount 
a projective- measurement FPB attack with Pe > 1/3 
because, as shown in Fig. 2, her Renyi information 
decreases — from a 1 bit per error-free sifted bit to — 
as Pe increases from 1/3 to 1/2. 

Let the outcomes Eve associates with the POVM el- 
ements n_|_,n_, and Ilinc be denoted T+,T-, and Ti„c. 
They represent, respectively. Eve's thinking that her tar- 
get qubit's output state was |T_|_), |T_), or that her mea- 
surement was inconclusive. When Alice and Bob have 
both used the H/V basis. Eve will decode her out- 
come as V , and her T_ outcome as H , after that basis 



FIG. 5: Measurement basis for Eve's conclusive-probe POVM 
discrimination between |r+) and |T_); figure assumes < 
Pe < 1/3. 



choice is revealed. Likewise, when Alice and Bob have 
both used the ±45° basis. Eve will decode her T+ out- 
come as +45° and her T_ outcome as —45° after basis 
revelation. It is now a simple matter to evaluate the 
joint Alice {A), Bob (B), and Eve {E) probabilities that 
we will need to understand the performance of Brandt's 
conclusive entangling probe. Because only bits for which 
Alice and Bob have chosen the same polarization basis 
need be considered, all of the probabilities we shall evalu- 
ate and employ below will be conditioned on there being 
an Alice/Bob sift event. However, for notational simplic- 
ity, we shall not carry that conditioning along explicitly. 
Also, for the sake of brevity, we will only present the 
calculation details for the case in which Alice sends an 
i?-polarized photon. The complete set of ABE sifted-bit 
joint probabilities appears in Table I. 

When there is a sift event in which Alice has sent an 
//-polarized photon, the joint state of Bob's qubit and 
Eve's, found from Eq. iQ, is 

\^h)^\H)\T_) + \V)\Te), (18) 

and Bob measures his qubit with the projectors 

Uh = \H){H\ (19) 
ny = \V){V\. (20) 



Thus, the joint conditional probability that Bob and Eve 
will both measure H is found as follows: 



Vy{B ^ H,E ^ H \ A^ H 



\{T-\n)? 

2C2 



2Pe- (21) 



Proceeding in the same way we can obtain the other joint 
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conditional probabilities for the A = H case: 
PiiB = V,E = H \ A = H) = 



2C2 



Pe/2 (22) 



Pii B ^ H,E \ H) = 



2C2 







(23) 



Pr( B = K = y I A = ) = 

\{Te\T^)\' 



(V'ff|(ny®n+)|V'H) = 



2C2 



Pr( B = i/, = inc I A = i? ) = 

C2 - 52/2 



(0ff|(n// (g)ni„c)|V'if> 



C2 



Pr( B = y, £ = inc I A = ) = 

C2 - 52/2 



{^H\{Tlv®ninc)\^H) 

0. 



C2 



= Pi;/2 (24) 

\{T-\+)\' 

(25) 

(26) 



Conditioned on there being a sift event, the ABE joint 
probabilities in which A ~ H are gotten by multiplying 
the preceding conditional probabilities by Pr(A = i/) = 
1/4. Similar calculations yield the full set of ABE joint 
probabilities given in Table I. Because this table includes 
all ABE possibilities that are consistent with the occur- 
rence of an Alice/Bob sift event, its probabilities — which 
are conditioned on there being such a sift event — sum to 
one. 

The probabilities listed in Table I have three interest- 
ing characteristics. Eve is using the POVM for unam- 
biguous discrimination between |T+) and Thus, 
whenever Eve's measurement outcome is or r_ and 
Bob's sifted bit value agrees with Alice's, Eve will not 
make an error, e.g., Pr(A = H,B = H,E = V) = 0, 
in keeping with the notion of unambiguous detection. It 
might also be expected 0-0 that when Eve's measure- 
ment outcome is T+ or T_ — i.e., when it is not Tine so 
that she thinks her measurement is conclusive — that Bob 
never suffers a sifted-bit error. Table I shows that such is 
not the case, e.g., Pr(A ^ H,B ^V,E = H) = Pe/S is 
non-zero for < Pe < 1/3. This deviation from unam- 
biguous detection occurs because Eve's target qubit may 
be in one of three different states: |r_), or \Te)- 

The presence of |T|e), which is not orthogonal to |T_^) or 
\T^) for < Pe < /1/3, is directly responsible for Bob's 
sometimes receiving sifted bits that differ from Alice's. 
On the other hand, when Eve's measurement outcome is 
Tine, Alice and Bob have no errors on their sifted bits. 

The quantities we need to complete our performance 
analysis of Brandt's conclusive entangling probe can all 
be obtained from Table I. Let A = {0,1}, B = {0,1} 
and 8 — {0, l,inc} denote the ensembles of possible bit 
values that Alice sends, and Bob and Eve receive, where 
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TABLE I: Joint probabilities for Alice, Bob, and Eve condi- 
tioned on there being an Alice/Bob sift event and assuming 
0<Pe< 1/3. 



we assume the following H/V and ±45° encodings: 

^ iJ, 1 -> y, for H/V basis (27) 
0^ +45°,1 -> -45°, for ±45° basis. (28) 

The joint abe probabilities, conditioned on there being 
a sift event, are listed in Table II; they were obtained 
by adding the appropriate Table I probabilities in accor- 
dance with the preceding H/V and ±45° encodings. 

We want to find: Pr(6 7^ a), the Alice/Bob error prob- 
ability; Pr(e = inc), the probability that Eve regards her 
measurement as inconclusive; and Ir, the Renyi entropy 
Eve derives about Bob's error- free sift events. From Ta- 
ble II we immediately find that 



Pr(6 7^ a) 
Pr(e = inc) 



Pe 

1 - 3Pe- 



(29) 
(30) 



The Renyi information (in bits) that Eve learns about 
each Alice/Bob error- free sift event is 

In ^ -log2(^^[Pr(6|fe = a)]2^ 
+ ^Pr(e I 6 = a) 

e 

X log2|^^[Pr(6|e,6 = a)]2^ . (31) 
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TABLE 11: Joint bit probabilities for Alice, Bob, and Eve con- 
ditioned on there being an Alice/Bob sift event and assuming 
< Pb < 1/3. 



From Table II we find that 




0.05 0.1 0.15 0.2 0.25 0.3 

Pe 

FIG. 6: Eve's Renyi information about Bob's error-free sifted 
bits as a function of the error probability that her eavesdrop- 
ping creates. Upper curve: Fuchs-Peres-Brandt probe with 
minimum-error- probability projective measurement. Lower 
curve: Brandt's conclusive entangling probe with POVM. 



Pr(6 = j I fe = a) = 1/2, for j = 0, 1 (32) 



, forfc = 0,l 
Pr(e = fc|& = a)= <[ (33) 
iJp^ , for k = inc 



Pr{b^j\e^j,b = a) = l, for j = 0, 1 (34) 

and 

Pr(6 = j I e = inc,6 = a) = 1/2, for j = 0,1, (35) 
whence 

2Pe 



Ir = 



1-Pe' 



(36) 



IV. DISCUSSION 

We are now ready to evaluate the merits of Brandt's 
conclusive entangling probe. For our ideal conditions, in 
which there is no propagation loss, no background light, 
and Eve and Bob have unity quantum efficiency photode- 
tectors with no dark counts, Eqs. (|29|l . H3U|I and (|3(j|l char- 
acterize the performance of this system when Eve routes 
all of Alice's photons to Bob. Equation H29() shows that 
Eve's actions have caused Alice and Bob to have an error 
probability of on their sifted bits, i.e., the same result 
as obtained for the FPB probe that uses the minimum- 
error-probability projective measurement. This comes as 
no surprise: the Alice/Bob error probability is caused by 
the CNOT gate, not by the measurement that Eve makes 
on her output of the CNOT gate. Equation (|30|) shows 



that Eve's probability of thinking her measurement is in- 
conclusive can be tuned to be anywhere between to 1 
by appropriate choice of Pe in the range < Pe < 1/3. 
When Pe = 0, Eve's Pr(inc) = 1, because |T+) = |T_) 
in this case. When Pe = 1/3, Eve's Pr(inc) = 0, be- 
cause (T+|T_) = in this case. Of greater interest is the 
behavior of Eve's Renyi information when she uses the 
conclusive entangling probe. To compare the information 
Eve receives from the FPB probe with what she gets from 
the Brandt's conclusive entangling probe we have plotted 
the Renyi informations (in bits) from Eqs. and H36() 
in Fig. 6 for < Pe < 1/3. We see that both increase 
from to 1 bit per error-free sifted bit as Pe increases 
from to 1/3. Both probes yield zero Renyi information 
when Pe = 0, because \T+) = |r_) and \Te) = in this 
case, i.e.. Eve's target-qubit output state is not entangled 
with Bob's qubit. Both probes yield 1 bit of Renyi in- 
formation per error-free sifted bit when Pe = 0, because 
(T+|T_) = in this case. However, for < < 1/3, the 
Renyi information obtained from the FPB probe (with its 
minimum-error-probability projective measurement) ex- 
ceeds that found by using the conclusive entangling probe 
(with its POVM measurement). 

The preceding performance comparison is unfair to 0- 
9], in that these papers offer the conclusive entangling 
probe as a means to make BB84 QKD vulnerable when 
there is loss between Alice's transmitter and Bob's re- 
ceiver. As an extreme version of the scenario contem- 
plated in these works, suppose that: Alice's transmitter 
and Bob's receiver are connected by a pure-loss (no excess 
noise) channel of transmissivity < 77 < 1; Eve connects 
Alice's transmitter to the control qubit of her CNOT 
gate by a lossless channel; and Eve can send photons on 
to Bob's receiver through another lossless channel. Then, 
according to 0-0, Eve can use a conclusive entanghng 
probe with Pr(e = inc) = 1 — r/, get error-free measure- 
ments on all sifted bits for which her outcome is not Tjnc, 



6 



and route to Bob — through her lossless channel — only the 
control-qubit output photons for which her measurement 
was not Tine- For this arrangement, |3|~0 claim that 
Bob would obtain the same photon flux, and Alice and 
Bob would have no errors on their sifted bits, whether or 
not Eve's conclusive entangling probe was present. In ad- 
dition, according to 0~0' would obtain perfect in- 
formation about each of those error-free sifted bits when 
she used that probe. However, because the analysis in 
0-0 has neglected the ITe) component of Eve's target- 
qubit output state, the preceding conclusion is incorrect, 
as we will now show. 

Eve's Renyi information about Bob's error-free sifted 
bits, in the preceding scenario, satisfies 

In = -logJj2^PY{b\e^mc,b = a)]A 

\b=0 / 

1 

inc, a) 

e=Q 

X log2(^[Pr(6| e,e^inc,6 = a)]2 j . (37) 

\b=0 J 

The probabilities needed to evaluate this expression fol- 
low readily from Table II: 

Pr(6 = j I e ^ inc,6 = a) = 1/2, for j = 0, 1 (38) 
Pr(e A; I e 7^ inc,6 = a) = 1/2, for A: = 0, 1 (39) 



and 



Pr( b = j\ e = j,e^ inc, b — a) — 1, for j = 0, 1, 



from which we get 



(40) 



(41) 



in agreement with However, this perfect Renyi 

information does not come for free. In a final application 
of Table II we find that the Alice/Bob sifted-bit error 
probability for this conclusive-probe scenario is 



FT{b ^ a \ e ^ inc) ^ 1/3. 



(42) 



So, this form of the conclusive entangling probe achieves 
the same error-probability /Renyi- information trade-off 
as the FPB probe with Pe — 1/3. Hence it does not 
represent a hitherto unexpected vulnerability of BB84 
QKD. 
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